hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-28 22:56:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update Cache Poisoning rule

Browse Source
This commit is contained in:
Alvaro Muñoz
2024-05-15 22:08:03 +02:00
parent 731889bf88
commit 446765bcbb
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
ql/src/Security/CWE-349/CachePoisoning.ql
View File

@@ -18,11 +18,10 @@ import codeql.actions.security.PoisonableSteps
from LocalJob j, PRHeadCheckoutStep checkout, Step s
where
// Excluding privileged workflows since they can be easily exploited in similar circumstances
not j.isPrivileged() and
// The workflow runs in the context of the default branch
runsOnDefaultBranch(j) and
// The job checkouts untrusted code from a pull request
// TODO: Consider adding artifact downloads as a potential source of cache poisoning
j.getAStep() = checkout and
(
// The job writes to the cache
@@ -33,7 +32,9 @@ where
// The job executes checked-out code
// (The cache specific token can be leaked even for non-privileged workflows)
checkout.getAFollowingStep() = s and
s instanceof PoisonableStep
s instanceof PoisonableStep and
// Excluding privileged workflows since they can be easily exploited in similar circumstances
not j.isPrivileged()
)
select checkout, "Potential cache poisoning in the context of the default branch on step $@.", s,
s.toString()